Finding Gozi: An Italian Malspam Infection

An accounts workstation at Borsani Tessile tripped the SIEM this morning: a routine invoice click that turned into an outbound file transfer on an unusual port, then a stream of plain web traffic to addresses with no names attached. Before you pull threads, get oriented. This case starts in a mailbox and ends on the perimeter, and the analyst who caught it has handed it to you. Review the available surfaces and the incident window, then begin working the delivery.

The trail begins with one inbound message that slipped past sender authentication and pointed the recipient at a download instead of carrying the file itself, which kept it clear of the mail scanner. Establish who sent it.

Downloading and opening the archive did not just present a document. A file inside it turned a double-click into an outbound connection to a separate attacker host on a port that should never leave the building, and that connection pulled the real payload. Identify the external host the shortcut reached out to.

The file pulled across that connection was written to the user profile and then run. Recover the file name of the second-stage loader that the workstation fetched and executed.

Once the trojan ran, it tried a string of external addresses over plain web traffic, most of which went nowhere, before locking onto one and staying there through the day, including a large midday upload. To contain the host you need the address it settled on. Identify the primary command-and-control endpoint it kept returning to.

For the incident report, classify how the attacker ran the banking trojan through a trusted, signed Windows binary instead of executing it directly. Map that evasive behavior to its MITRE ATT&CK technique.